CVE-2026-19088

ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.

Affected

ShopEngine Elementor WooCommerce Builder Addon

CVSS v3.1 CNA

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.14% chance of exploitation in the next 30 days, 3rd percentile

Published

2026-08-13

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f58066e9-8066-43bc-8778-7ded279e8ee2/

References

• CVE Record
• NVD entry